Protections
How protection works
The order flowguard works through your code, in plain terms.
Flowguard reads your jar, applies a fixed sequence of changes, and writes a new jar. You don't control the order — only which steps are turned on — but knowing the shape of it helps explain why some settings depend on others.
The run, step by step
- Read the jar. Every class is parsed and checked for the markers described in Annotations.
- Rename, if enabled. Classes, methods and fields get new names before anything else happens, since later steps need to know the final names.
- Decide what goes native. If native protection is on, flowguard decides which marked methods will be compiled to native code.
- Go through each class. This is where most protections apply: clean-up, string and number protection, parameter protection, indirection, and the control-flow engine.
- Add any generated support code that some protections need at runtime.
- Compile and seal. Native methods are compiled; sealed classes are encrypted.
- Write the output jar. Sealed classes are written as separate encrypted resources instead of plain class files; everything else is written as usual.
Why order matters
A couple of protections read values that another protection creates. For example, string protection needs the control-flow engine's routing already in place, so flowguard always runs control flow first. You don't need to manage this — it's automatic — but it's why turning on string protection can change how control flow behaves even though you didn't touch that setting.